Insufficient Validation in MongoDB Server Aggregation Framework

CVE-2026-82073

What is CVE-2026-82073?

A security flaw in the MongoDB Server aggregation framework enables authenticated users with limited read privileges to bypass view-level authorization checks. This vulnerability allows unauthorized access to data from collections when using Atlas Search features. Insufficient validation of an internal command parameter, which can be manipulated by external clients, results in critical security checks being improperly bypassed.

References